Attachments to investigations are stored in a KV Store collection named investigation_attachment. KV Store is a feature that stores and manages data as key-value pairs. Splunk Enterprise Security uses KV Store to store investigation information in several collections, such as investigation, investigation_event, investigation_lead, and investigation_attachment. You can view or modify the KV Store collections using the KV Store API endpoint. For details about using the KV Store API endpoint, see KV Store endpoint descriptions in the Splunk Enterprise REST API Reference Manual1. The other options, B, C, and D, are not correct. Attachments to investigations are not stored in the notable index, the attachments.csv lookup, or the /etc/apps/SA-Investigations/default/ui/views/attachments directory. References =

Manage investigations in Splunk Enterprise Security